# US 2021/0243157 A1 · Maintaining internet protocol security tunnels > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243157 A1 - Document ID: US20210243157A1 - Status: Published application - Kind: A1 - Application number: 17/301,909 - Filed: 2021-04-19 - Published: 2021-08-05 - Earliest claimed: 2018-07-26 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Naresh Chand; Ranjan Sinha - Web page: https://patentgrep.com/patent/US20210243157A1 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/164: {at the network layer} - H04L 47/28: in relation to timing considerations - H04L 63/0272: {Virtual private networks} - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/1074: for supporting data block transmission mechanisms (file transfer H04L67/06) - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network device identifies an Internet Protocol Security (IPsec) tunnel that connects the network device to a remote device and determines that dead peer detection (DPD) is enabled at the network device. The network device receives a first DPD request message from the remote device via the IPsec tunnel, and sends a first DPD response message to the remote device via the IPsec tunnel. The network device determines that a workload of the network device satisfies a threshold amount, and sends one or more encapsulating security payload (ESP) packets that include traffic flow confidentiality (TFC) payload data to the remote device via the IPsec tunnel. The network device determines that the workload of the network device does not satisfy the threshold amount. The network device receives a second DPD request message from the remote device and sends a second DPD response message to the remote device via the IPsec tunnel. ## Claims ### Claim 1 A device, comprising: one or more memories; and one or more processors to: identify an Internet Protocol Security (IPsec) tunnel that connects the device to a remote device; determine that a dead peer detection (DPD) process is enabled at the device; identify a recurring interval associated with the DPD process; and maintain the IPsec tunnel, wherein, when maintaining the IPsec tunnel, the one or more processors are to: determine that there was no traffic on the IPsec tunnel during the recurring interval; and send, based on determining that there is no traffic on the IPsec tunnel during the recurring interval, one or more encapsulating security payload (ESP) packets via the IPsec tunnel. ### Claim 2 (depends on 1) The device of claim 1, wherein the one or more processors, when sending the one or more ESP packets are to: send the one or more ESP packets that include traffic flow confidentiality (TFC) payload data to the remote device via the IPsec tunnel. ### Claim 3 (depends on 2) The device of claim 2, wherein the one or more processors, when sending, based on determining that there is no traffic on the IPsec tunnel during the recurring interval, the one or more ESP packets to the remote device via the IPsec tunnel, are to: send the one or more ESP packets from a data plane of the device to the remote device via the IPsec tunnel. ### Claim 4 (depends on 1) The device of claim 1, wherein, when maintaining the IPsec tunnel, the one or more processors are to: listen for traffic on the IPsec tunnel during the recurring interval, wherein the one or more processors, when listening for traffic on the IPsec tunnel during the recurring interval, are to: determine whether the device sends one or more outgoing messages to the remote device via the IPsec tunnel during the recurring interval; and determine whether the device receives one or more incoming messages from the remote device via the IPsec tunnel during the recurring interval. ### Claim 5 (depends on 1) The device of claim 1, wherein the one or more processors, when determining that there was no traffic on the IPsec tunnel during the recurring interval, are to: determine that the device did not send or receive information via the IPsec tunnel during the recurring interval. ### Claim 6 (depends on 1) The device of claim 1, wherein the one or more ESP packets include a protocol value that indicates that the one or more ESP packets are dummy packets. ### Claim 7 (depends on 1) The device of claim 1, wherein the one or more ESP packets are formatted to cause the remote device to discard the one or more ESP packets upon receiving the one or more ESP packets. ### Claim 8 A method comprising: identifying, by a device, an Internet Protocol Security (IPsec) tunnel that connects the device to a remote device; identifying, by the device, a recurring interval associated with a dead peer detection (DPD) process; and sending, by the device and based on determining that there is no traffic on the IPsec tunnel during the recurring interval, one or more encapsulating security payload (ESP) packets via the IPsec tunnel to maintain the IPsec tunnel. ### Claim 9 (depends on 8) The method of claim 8, where sending the one or more ESP packets comprises: sending the one or more ESP packets that include traffic flow confidentiality (TFC) payload data to the remote device via the IPsec tunnel. ### Claim 10 (depends on 9) The method of claim 9, where sending the one or more ESP packets comprises: sending the one or more ESP packets from a data plane of the device to the remote device via the IPsec tunnel. ### Claim 11 (depends on 8) The method of claim 8, where sending the one or more ESP packets comprises: determining whether the device sends one or more outgoing messages to the remote device via the IPsec tunnel during the recurring interval; and determining whether the device receives one or more incoming messages from the remote device via the IPsec tunnel during the recurring interval. ### Claim 12 (depends on 8) The method of claim 8, where sending the one or more ESP packets comprises: determining that the device did not send information via the IPsec tunnel during the recurring interval. ### Claim 13 (depends on 8) The method of claim 8, wherein the DPD process is enabled at the device. ### Claim 14 (depends on 8) The method of claim 8, wherein the one or more ESP packets are formatted to cause the remote device to discard the one or more ESP packets upon receiving the one or more ESP packets. ### Claim 15 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to: identify an Internet Protocol Security (IPsec) tunnel that connects the device to a remote device; determine that a dead peer detection (DPD) process is enabled at the device; identify an interval associated with the DPD process; and maintain the IPsec tunnel, wherein, when maintaining the IPsec tunnel, the one or more processors are to: send, based on determining that there is no traffic on the IPsec tunnel during the interval, one or more encapsulating security payload (ESP) packets via the IPsec tunnel. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to send the one or more ESP packets, cause the one or more processors to: send the one or more ESP packets that include traffic flow confidentiality (TFC) payload data to the remote device via the IPsec tunnel. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the one or more instructions, that cause the one or more processors to send the one or more ESP packets, cause the one or more processors to: send the one or more ESP packets from a data plane of the device to the remote device via the IPsec tunnel. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to maintain the IPsec tunnel, cause the one or more processors to: listen for traffic on the IPsec tunnel during the interval, the interval being one of: a recurring interval, a trigger interval, or a periodic interval. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more instructions, that cause the one or more processors to determine that there was no traffic on the IPsec tunnel during the interval, cause the one or more processors to: determine that the device did not receive information via the IPsec tunnel during the interval. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more ESP packets include a protocol value that indicates that the one or more ESP packets are dummy packets.